US11263840B2 - Delegation and auxiliary condition for physical access - Google Patents

Abstract

It is provided a method for controlling access to a physical space. The method is performed in an access control device and comprises the steps of: communicating with an electronic key to obtain an identity of the electronic key; obtaining a plurality of delegations; determining, from one of the delegations, that there is an auxiliary condition, wherein the auxiliary condition is that access is approved for the electronic key by an auxiliary party, authenticated by a digital signature by the auxiliary party; and granting access to the physical space when the plurality of delegations comprises a sequence of delegations covering a delegation path from the access control device to the electronic key such that, in the sequence of delegations, the delegator of the first delegation is the access control device, the receiver of the last delegation is the electronic key, and the auxiliary condition is fulfilled.

Description

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a national stage application under 35 U.S.C. 371 and claims the benefit of PCT Application No. PCT/EP2018/054521 having an international filing date of 23 Feb. 2018, which designated the United States, which PCT application claimed the benefit of Sweden Patent Application No. 1750200-6 filed 24 Feb. 2017, the disclosure of each of which are incorporated herein by reference.

TECHNICAL FIELD

The invention relates to a method, an access control device, a computer program and a computer program product relating to controlling access to a physical space using an auxiliary condition.

BACKGROUND

Locks and keys are evolving from the traditional pure mechanical locks. These days, there are wireless interfaces for access control devices controlling to access using electronic locks, e.g. by interacting with an electronic key. Such wireless interfaces improve usability while electronic key management is significantly more flexible regarding management of access rights compared to pure mechanical locks, especially when a local access control device communicates with an access control server to verify access rights for a particular electronic key. In that way, access for a particular electronic key can be managed centrally by managing the access rights stored in the access control server.

However, there are a number of problems with this approach of central access right management. One problem is scalability, since the server and communication paths need to be scaled when new locks and access control devices are deployed. Moreover, the system is vulnerable in the sense that the server needs to be available for verifying access.

There are also offline systems available, where access rights are stored in the lock or in the key. However, the offline systems are either very simple and non-flexible, or managed by intermittent access to a server, which gives the same problems as for an online system, albeit to a less degree.

SUMMARY

It is an object of embodiments presented herein to provide an improved way to control access to a physical space.

According to a first aspect, it is provided a method for controlling access to a physical space. The method is performed in an access control device and comprises the steps of: communicating with an electronic key to obtain an identity of the electronic key; obtaining a plurality of delegations, wherein each delegation is a delegation from a delegator to a receiver; determining, from one of the delegations in the plurality of delegations, that there is an auxiliary condition, wherein the auxiliary condition is that access is approved for the electronic key by an auxiliary party, authenticated by a digital signature by the auxiliary party; and granting access to the physical space when the plurality of delegations comprises a sequence of delegations covering a delegation path from the access control device to the electronic key such that, in the sequence of delegations, the delegator of the first delegation is the access control device, the receiver of the last delegation is the electronic key, and the auxiliary condition is fulfilled.

The auxiliary party is an employer of a person associated with the electronic key, in which case, one receiver in the sequence of delegations is an access right coordinator.

The auxiliary party may be an access right coordinator and wherein one receiver in the sequence of delegations is an employer of a person associated with the electronic key.

The step of obtaining a plurality of delegations may comprise obtaining at least one delegation from storage of the access control device.

The first delegation may be obtained from storage of the access control device.

The step of obtaining a plurality of delegations may comprise obtaining at least one delegation from the electronic key.

Each delegation obtained from the electronic key may be digitally signed by the delegator of the respective delegation.

The method may further comprise the step of: evaluating any time constraints of all of the plurality of delegations, in which case the step of granting access is only performed when none of the time constraints are violated.

In one embodiment, the auxiliary part is not a delegator in the sequence of delegations.

According to a second aspect, it is provided an access control device for controlling access to a physical space. The access control device comprises: a processor; and a memory storing instructions that, when executed by the processor, causes the access control device to: communicate with an electronic key to obtain an identity of the electronic key; obtain a plurality of delegations, wherein each delegation is a delegation from a delegator to a receiver; determine, from one of the delegations in the plurality of delegations, that there is an auxiliary condition, wherein the auxiliary condition is that access is approved for the electronic key by an auxiliary party, indicated by a digital signature by the auxiliary party; and grant access to the physical space when the plurality of delegations comprises a sequence of delegations covering a delegation path from the access control device to the electronic key such that, in the sequence of delegations, the delegator of the first delegation is the access control device, the receiver of the last delegation is the electronic key, and the auxiliary condition is fulfilled.

The auxiliary party may be an employer of a person associated with the electronic key, in which case one receiver in the sequence of delegations is an access right coordinator.

The auxiliary party may be an access right coordinator, in which case one receiver in the sequence of delegations is an employer of a person associated with the electronic key.

The instructions to obtain a plurality of delegations may comprise instructions that, when executed by the processor, causes the access control device to obtain at least one delegation from storage of the access control device.

The first delegation may be obtained from storage of the access control device.

The instructions to obtain a plurality of delegations may comprise instructions that, when executed by the processor, causes the access control device to obtain at least one delegation from the electronic key.

Each delegation obtained from the electronic key may be digitally signed by the delegator of the respective delegation.

The access control device may further comprise instructions that, when executed by the processor, causes the access control device to: evaluate any time constraints of all of the plurality of delegations; and only perform the instructions to grant access when none of the time constraints are violated.

According to a third aspect, it is provided a computer program for controlling access to a physical space. The computer program comprises computer program code which, when run on a access control device causes the access control device to: communicate with an electronic key to obtain an identity of the electronic key; obtain a plurality of delegations, wherein each delegation is a delegation from a delegator to a receiver; determine, from one of the delegations in the plurality of delegations, that there is an auxiliary condition, wherein the auxiliary condition is that access is approved for the electronic key by an auxiliary party, indicated by a digital signature by the auxiliary party; and grant access to the physical space when the plurality of delegations comprises a sequence of delegations covering a delegation path from the access control device to the electronic key such that, in the sequence of delegations, the delegator of the first delegation is the access control device, the receiver of the last delegation is the electronic key, and the auxiliary condition is fulfilled.

According to a fourth aspect, it is provided a computer program product comprising a computer program according to the third and a computer readable means on which the computer program is stored.

By enforcing both a sequence of delegations and the auxiliary condition in the access control device, any party (delegator), such as an access right coordinator, in the sequence of delegations can control when access should be allowed. However, since also the auxiliary condition needs to be fulfilled, the access right coordinator only provides a necessary but not sufficient condition for the access control device granting access. In other words, the access right coordinator does not hold any master keys nor is the access right coordinator even free to provide a key to itself for access via the access control device. This improves security greatly since there is no single point in the system where an attacker could gain access.

According to a fifth aspect, it is provided a method for controlling access. The method is performed in an access control device and comprises the steps of: performing an electronic authentication of a user device; obtaining a plurality of delegations, wherein each delegation is a delegation from a delegator to a receiver; determining, from one of the delegations in the plurality of delegations, that there is an auxiliary condition, wherein the auxiliary condition is that access is approved for the user device by an auxiliary party, authenticated by a digital signature by the auxiliary party; and granting access to the physical space when the plurality of delegations comprises a sequence of delegations covering a delegation path from the access control device to the user device such that, in the sequence of delegations, the delegator of the first delegation is the access control device, the receiver of the last delegation is the user device, and the auxiliary condition is fulfilled.

In the fifth aspect, the access is not limited to a physical space but could be e.g. an access to configure an access control device, reset an access control device, send an identity, etc.

Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise herein. All references to “a/an/the element, apparatus, component, means, step, etc.” are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, step, etc., unless explicitly stated otherwise. The steps of any method disclosed herein do not have to be performed in the exact order disclosed, unless explicitly stated.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention is now described, by way of example, with reference to the accompanying drawings, in which:

FIG. 1 is a schematic diagram showing an environment in which embodiments presented herein can be applied;

FIGS. 2A-B are flow charts illustrating methods for controlling access to a physical space, performed in the access control device ofFIG. 1;

FIG. 3 illustrates a scenario applicable by embodiments presented herein where a user delegates access to an Access Right Coordinator for access by a home care company;

FIG. 4 andFIG. 5 are schematic illustrations illustrating examples of delegations that can be used in the access control device ofFIG. 1;

FIG. 5 is a schematic diagram illustrating some components of an access control device according toFIG. 1; and

FIG. 6 shows one example of a computer program product comprising computer readable means.

DETAILED DESCRIPTION

The invention will now be described more fully hereinafter with reference to the accompanying drawings, in which certain embodiments of the invention are shown. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Like numbers refer to like elements throughout the description.

FIG. 1 are schematic diagrams showing an environment in which embodiments presented herein can be applied. Access to aphysical space16 is restricted by aphysical barrier15, which is selectively unlockable. Thephysical barrier15 stands between the restrictedphysical space16 and an accessiblephysical space14. Note that the accessiblephysical space14 can be a restricted physical space in itself, but in relation to this particularphysical barrier15, the accessiblephysical space14 is accessible. Thebarrier15 can be a door, gate, hatch, window, drawer, lockable packaging, etc. In order to unlock thebarrier15, anaccess control device1 is provided. Theaccess control device1 is connected to (or combined with) aphysical lock12, which is controllable by theaccess control device1 to be set in an unlocked state or locked state. Theaccess control device1 is mounted close to thephysical lock12. Thebarrier15 is provided in a surrounding fixed structure, such as a wall or fence.

Theaccess control device1 is able to receive and send signals from/to anelectronic key2 over acommunication channel3 which may be a short-range wireless interface or a conductive (i.e. galvanic/electric) connection. Theelectronic key2 is any suitable device which is portable by a user and which can be used for authentication over thecommunication channel3. The portable key is associated with the user. Theelectronic key2 is typically carried or worn by a user and may be implemented as a physical key, a key fob, wearable device, smart phone, etc. The short-range wireless interface is a radio frequency wireless interface and could e.g. employ Bluetooth, Bluetooth Low Energy (BLE), ZigBee, Radio Frequency Identification (RFID), any of the IEEE 802.11 standards, any of the IEEE 802.15 standards, wireless Universal Serial Bus (USB), etc. The electronic key can also be considered to be a credential. Using thecommunication channel3, the identity of theelectronic key2 can be obtained. Moreover, the authenticity of the identity of theelectronic key2 can be checked, e.g. using a challenge and response scheme or by verifying a digital signature. In any case, an identity of theelectronic key2 is obtained, which is used in the process to grant or deny access as explained in more detail below.

When access is granted, theaccess control device1 sends an unlock signal to thelock12, whereby thelock12 is set in an unlocked state. In this embodiment, this can e.g. imply a signal over a wire-based communication interface, e.g. using Universal Serial Bus (USB), Ethernet, a serial connection (e.g. RS-485 or RS-232) or even a simple electric connection, or alternatively signal over a wireless communication interface. When thelock12 is in an unlocked state, thebarrier15 can be opened and when thelock12 is in a locked state, thebarrier15 cannot be opened. In this way, access to aclosed space16 is controlled by theaccess control device1. It is to be noted that theaccess control device1 and/or thelock12 can be mounted in the fixed structure by the physical barrier15 (as shown) or in thephysical barrier15 itself (not shown). Optionally, thelock12 andaccess control device1 are combined in one unit.

Optionally, energy harvesting of mechanical user actions and/or environmental power (solar power, wind, etc.) can be utilised to prolong the life span of the battery or even to allow a battery to be omitted for theaccess control device1 and/or thelock12.

FIGS. 2A-B are flow charts illustrating methods for controlling access to a physical space, performed in the access control device ofFIG. 1. First, the embodiments illustrated byFIG. 2A will be described.

In a communicate withkey step40, the access control device communicates with an electronic key to obtain an identity of the electronic key. The identity can be authenticated, e.g. as explained above.

In an obtain delegations step42, a plurality of delegations is obtained. Each delegation is a data item indicating a delegation from a delegator to a receiver. Optionally, this step comprises obtaining at least one delegation from a (local and persistent) storage of the access control device. For instance, the first delegation, being a delegation from the access control device, can be obtained from storage of the access control device. Optionally, this step comprises obtaining at least one delegation from the electronic key. In such a case, each delegation obtained from the electronic key can be mandated to be digitally signed by the delegator of the respective delegation, i.e. delegations obtained from the electronic key which are not validly signed are discarded. It is to be noted that the first delegation can be implemented by assigning one or more owners in the configuration of the access control device. In other words, optionally, the first delegation can be implemented differently from the subsequent delegations in the sequence.

In a determineauxiliary condition step44, the access control device determines, from one of the delegations in the plurality of delegations, that there is an auxiliary condition. The auxiliary condition is that access needs to be approved for the electronic key by an auxiliary party. This approval is authenticated by a digital signature by the auxiliary party. In one embodiment, the auxiliary condition is derived from the first delegation, e.g. a delegation from the access control device. This corresponds to the owner of the access control device defining the auxiliary condition.

The authentication by the auxiliary part can be implemented using a delegation sequence (of one or more delegations), comprising a delegation from the auxiliary party, to the electronic key.

In one embodiment, the auxiliary party is an employer of a person associated with the electronic key. In such a situation, one receiver in the sequence of delegations is an access right coordinator.

In one embodiments, the auxiliary party is an access right coordinator. In such a case, one receiver in the sequence of delegations is an employer of a person associated with the electronic key.

In a conditionalvalid sequence step45, it is determined whether the plurality of delegations comprise a sequence of delegations covering a delegation path from the access control device to the electronic key such that, in the sequence of delegations, the delegator of the first delegation is the access control device, the receiver of the last delegation is the electronic key, and the auxiliary condition is fulfilled. In the sequence of delegations, for each delegation except the first delegation, each delegator is the receiver of the preceding delegation. If this determination is affirmative, the method proceeds to agrant access step46. Otherwise, the method ends.

In thegrant access step46, access to the physical space is granted. This results in an unlock signal being sent to the lock as explained above.

It is to be noted that a delegation can optionally be provided with a limitation to further delegations by the receiver of the delegation. For instance, a delegation can be provided with no right to further delegations by the receiver, with unlimited rights to further delegations, or with a right to delegate a certain number of further steps away from the delegator. This can be enforced in the access control device by verifying that no such limitation in further delegations is violated prior to granting access.

Looking now toFIG. 2B, only new or modified steps compared to the method illustrated byFIG. 2A are described.

In an optional conditional timeconstraints limiting step47, any time constraints of all of the plurality of delegations are evaluated. It is to be noted that, depending on the circumstances, only a subset (or none) of the delegations could contain time constraints. When none of the time constraints are violated, the method proceeds to thegrant access step46. Otherwise, the method ends.

It is to be noted that the order ofsteps45 and47 is not important and can be shifted as desired.

Some examples will now be presented to illustrate what is made possible with the solutions presented herein. In the examples here, while delegations are mentioned to be delegations to users, to make the description clearer, the delegations are implemented as delegations to electronic keys of the users. In other words, when a delegation to a user is mentioned, it is in fact a delegation to an electronic key associated with that user.

FIG. 3 illustrates a scenario applicable by embodiments presented herein where a user delegates access to an Access Right Coordinator for access by a home care company.

Here, there is a situation where Tim, owning theaccess control device1, should provide access forBill24, who works for a home care company Help Inc. However, Tim would like to provide access for anyone being approved Help Inc., since Tim does not know who will provide the service on each particular occasion. An Access Right Coordinator (ARC) coordinates the key management for many different users and potentially many different employers.

Tim thus configures afirst delegation18afrom theaccess control device1 to theARC25. However, the first delegation contains an auxiliary condition.

The auxiliary condition states that access needs to be approved for the electronic key by an auxiliary party, in this case Help Inc. (indicated by ‘H’ on the label of thefirst delegation18a). In this way, the ARC could not use the delegation directly (or to one of its employees) to thereby gain access to the physical space, since the employees of ARC are not approved by Help Inc.

However, Help Inc.26 provides a second delegation toBill24. Thesecond delegation18bis digitally signed by Help Inc.26. Thesecond delegation18bcan be provided for storage by theARC25 or in a host device (e.g. smartphone) of the electronic key ofBill24. Since thesecond delegation18bis digitally signed by Help Inc.26, thissecond delegation18bcannot be manipulated by theARC25.

ForBill24 to gain access, theARC25 provides athird delegation18cfrom the ARC to Bill24 (or more accurately the electronic key of Bill24). The electronic key ofBill24 can e.g. be stored in an app on a smartphone. This app can also store thesecond delegation18b.

WhenBill24 approaches theaccess control device1, there is now a sequence of delegations from theaccess control device1 to Bill24, consisting of thefirst delegation18aand thethird delegation18c. Moreover, the auxiliary condition is satisfied by thesecond delegation18b. Hence,Bill24 will be granted access by theaccess control device1.

In this way, thefirst delegation18aby Tim can be securely stored by theARC25 while Help Inc.26 is in control of who they approve, i.e. whom they employ or hire.

Still, the day to day management of keys can be maintained by theARC25, who can issue thethird delegation18cwhen deemed necessary, e.g. according to a schedule. Thethird delegation18ccan have a limited validity time (e.g. 24 hours or 8 hours), to ensure that theARC25 is in control of access in accordance with the schedule. Meanwhile, thesecond delegation18bcan have a long validity time (months, years, . . . ) since the fine grained access can be controlled by thethird delegation18c. In this way, Help Inc.26 is relieved from the task of fine-grained access control. Moreover, it is easier to store securely a key pair for signing when it is rarely used and its use is manually initiated. Help Inc. can store their key pair locked up in a safe and only use the key pair e.g. once a year for existing employees and when a new employee starts.

In the prior art, theARC25 holds master keys to be able to issue access to theaccess control device1, e.g. according to a schedule. In contrast, using the embodiments presented herein, theARC25 does not have a master key for anycontrol devices1. In fact, theARC25 cannot by itself issue access, but only in conjunction with a delegation by the auxiliary party, in this case Help Inc.26. In other words, while theARC25 can control daily schedules and access rights as needed, this is only applicable for entities which are also delegated an access right by theauxiliary party26.

If Tim switches home care company from Help Inc. to Care Inc., he replaces thefirst delegation18awith a delegation toARC25 with a new auxiliary condition that access needs to be approved for the electronic key by a new auxiliary party, now being Care Inc. In this way, access is barred from any employees of Help Inc. while access is now instead provided for employees of Care Inc.

The access control device only allows access when delegations from two separate paths are provided to the access control device. It can thus be seen how theARC25 could securely store a great number offirst delegations18aand a great number of second delegations IA, and thus issuethird delegations18cwhen needed, with the important limitation of access only being granted for those individuals who are approved by the auxiliary party indicated on thefirst delegation18a.

FIG. 4 illustrates a scenario applicable by embodiments presented herein where a user delegates access to a home care company.

In this scenario, Tim sets afirst delegation18afrom theaccess control device1 to Help Inc.26, with an auxiliary condition. The auxiliary condition states that access needs to be approved for the electronic key by an auxiliary party, in this case ARC25 (indicated by ‘A’ on the label of thefirst delegation18a).

Help Inc.26 issues asecond delegation18bto Bill24 (or more accurately, the electronic key associated with Bill). In parallel, theARC26 issues athird delegation18ctoBill24.

OnceBill24 is by the access control device, there is a sequence of delegations and the auxiliary condition is fulfilled, whereby Bill is granted access.

Using this embodiment, theARC25 can remove access forBill24 if necessary.

Another possible scenario is that the second delegation is a delegation from Help Inc.26 to theARC25. This would still satisfy the auxiliary condition of thefirst delegation18a.

It is to be noted that, in the scenarios ofFIGS. 3 and 4, additional auxiliary conditions can be added in thefirst delegation18a. For instance, the first delegation can contain an additional auxiliary condition that the user (Bill) should be a certified nurse, which can be represented by a further delegation from a nursing certification authority to Bill.

In one embodiment, it may be sufficient that only a subset of the conditions (delegations) are satisfied, e.g. two of three conditions (delegations).

By using the delegation sequence as described here, great flexibility and control is provided without the need for a central access server, since all delegations can occur without any online access by the access control device. Delegations can be made in any suitable way directly or indirectly, supporting new business cases not possible using prior art systems. By supporting many use cases and scenarios, a single type of lock can be used, i.e. there no need for multiple versions of the lock for different uses, greatly reducing costs in development, production and distribution.

Also, by not requiring a central server, massive scalability is provided. Security is also improved since there is no single point, which can be attacked by an attacker, controlling access for all locks. Through the use of the sequence comprising signed delegations, non-repudiation is achieved. The non-repudiation is achieved for the delegations that are digitally signed. Optionally, all delegations are digitally signed to achieve a complete sequence of non-repudiable delegations. The non-repudiations may e.g. allow a lock owner to prove (in a court of law) that access was delegated by a package delivery company to a particular person when that person performs a criminal action (e.g. theft) in the house of the lock owner. The package delivery company cannot deny the delegation. In many jurisdictions, digital signatures have the same status as paper signatures.

FIG. 5 is a schematic diagram showing some components of theaccess control device1 ofFIG. 1. Aprocessor60 is provided using any combination of one or more of a suitable central processing unit (CPU), multiprocessor, microcontroller, digital signal processor (DSP), application specific integrated circuit etc., capable of executingsoftware instructions66 stored in amemory64, which can thus be a computer program product. Theprocessor60 can be configured to execute the method described with reference toFIGS. 2A-B above.

Thememory64 can be any combination of read and write memory (RAM) and read only memory (ROM). Thememory64 also comprises persistent storage, which, for example, can be any single one or combination of magnetic memory, optical memory, solid state memory or even remotely mounted memory.

Adata memory65 is also provided for reading and/or storing data during execution of software instructions in theprocessor60. Thedata memory65 can be any combination of read and write memory (RAM) and read only memory (ROM) which may be persistent and/or volatile memory. Thedata memory65 can form part of theaccess control device1 or be external, but local to, theaccess control device1. Thedata memory65 can store delegations as described above. The delegations can be stored in a persistent part of thedata memory65, e.g. in a flash memory.

Theaccess control device1 further comprises an I/O interface67 for communicating with other external entities such as thelock12 and theelectronic key2. The I/O interface67 may also comprise a reader for reading key cards with a magnetic strip or a smart card. The I/O interface67 may support wire-based communication, e.g. using Universal Serial Bus (USB), Ethernet, or even a simple electric connection (e.g. to the lock12) or a galvanic/electric connection for communicating with theelectronic key2. Alternatively or additionally, the I/O interface67 supports wireless communication, e.g. using Bluetooth, BLE, ZigBee, RFID, any of the IEEE 802.11 standards, any of the IEEE 802.15 standards, wireless USB, etc., e.g. for communication with theelectronic key2.

Other components of theaccess control device1 are omitted in order not to obscure the concepts presented herein.

Optionally, thelock12 ofFIG. 1 forms part of theaccess control device1.

FIG. 6 shows one example of a computer program product comprising computer readable means. On this computer readable means acomputer program91 can be stored, which computer program can cause a processor to execute a method according to embodiments described herein. In this example, the computer program product is an optical disc, such as a CD (compact disc) or a DVD (digital versatile disc) or a Blu-Ray disc. As explained above, the computer program product could also be embodied in a memory of a device, such as thecomputer program product64 ofFIG. 5. While thecomputer program91 is here schematically shown as a track on the depicted optical disk, the computer program can be stored in any way which is suitable for the computer program product, such as a removable solid state memory, e.g. a Universal Serial Bus (USB) drive.

The invention has mainly been described above with reference to a few embodiments. However, as is readily appreciated by a person skilled in the art, other embodiments than the ones disclosed above are equally possible within the scope of the invention, as defined by the appended patent claims.

Claims (18)

What is claimed is:

1. A method for controlling access to a physical space, the method being performed in an access control device and comprising:

communicating with an electronic key to obtain an identity of the electronic key;

obtaining a plurality of delegations, wherein each delegation is a data item indicating a delegation from a delegator to a receiver;

determining, from one of the delegations in the plurality of delegations, that there is an auxiliary condition, wherein the auxiliary condition is that access is approved for the electronic key by an auxiliary party, authenticated by a digital signature by the auxiliary party; and

granting access to the physical space when the plurality of delegations comprises a sequence of delegations covering a delegation path from the access control device to the electronic key such that, in the sequence of delegations, the delegator of the first delegation is the access control device, the receiver of the last delegation is the electronic key, and the auxiliary condition is fulfilled.

2. The method according toclaim 1, wherein the auxiliary party is an employer of a person associated with the electronic key, and wherein one receiver in the sequence of delegations is an access right coordinator.

3. The method according toclaim 1, wherein the auxiliary party is an access right coordinator and wherein one receiver in the sequence of delegations is an employer of a person associated with the electronic key.

4. The method according toclaim 1, wherein obtaining a plurality of delegations comprises obtaining at least one delegation from storage of the access control device.

5. The method according toclaim 4, wherein the first delegation is obtained from storage of the access control device.

6. The method according toclaim 1, wherein obtaining a plurality of delegations comprises obtaining at least one delegation from the electronic key.

7. The method according toclaim 6, wherein each delegation obtained from the electronic key is digitally signed by the delegator of the respective delegation.

8. The method according toclaim 1, further comprising:

evaluating any time constraints of all of the plurality of delegations; and

wherein granting access is only performed when none of the time constraints are violated.

9. The method according toclaim 1, wherein the auxiliary party is not a delegator in the sequence of delegations.

10. An access control device for controlling access to a physical space, the access control device comprising:

a processor; and

a memory storing instructions that, when executed by the processor, causes the access control device to:

communicate with an electronic key to obtain an identity of the electronic key;

obtain a plurality of delegations, wherein each delegation is a data item indicating a delegation from a delegator to a receiver;

determine, from one of the delegations in the plurality of delegations, that there is an auxiliary condition, wherein the auxiliary condition is that access is approved for the electronic key by an auxiliary party, indicated by a digital signature by the auxiliary party; and

grant access to the physical space when the plurality of delegations comprises a sequence of delegations covering a delegation path from the access control device to the electronic key such that, in the sequence of delegations, the delegator of the first delegation is the access control device, the receiver of the last delegation is the electronic key, and the auxiliary condition is fulfilled.

11. The access control device according toclaim 10, wherein the auxiliary party is an employer of a person associated with the electronic key, and wherein one receiver in the sequence of delegations is an access right coordinator.

12. The access control device according toclaim 10, wherein the auxiliary party is an access right coordinator and wherein one receiver in the sequence of delegations is an employer of a person associated with the electronic key.

13. The access control device according toclaim 10, wherein the instructions to obtain a plurality of delegations comprise instructions that, when executed by the processor, causes the access control device to obtain at least one delegation from storage of the access control device.

14. The access control device according toclaim 13, wherein the first delegation is obtained from storage of the access control device.

15. The access control device according toclaim 10, wherein the instructions to obtain a plurality of delegations comprise instructions that, when executed by the processor, causes the access control device to obtain at least one delegation from the electronic key.

16. The access control device according toclaim 15, wherein each delegation obtained from the electronic key is digitally signed by the delegator of the respective delegation.

17. The access control device according toclaim 10, further comprising instructions that, when executed by the processor, causes the access control device to:

evaluate any time constraints of all of the plurality of delegations; and

only perform the instructions to grant access when none of the time constraints are violated.

18. A non-transitory computer-readable medium comprising a computer program stored thereon for controlling access to a physical space, the computer program comprising computer program code which, when run on a access control device causes the access control device to:

communicate with an electronic key to obtain an identity of the electronic key;

obtain a plurality of delegations, wherein each delegation is a data item indicating a delegation from a delegator to a receiver;

determine, from one of the delegations in the plurality of delegations, that there is an auxiliary condition, wherein the auxiliary condition is that access is approved for the electronic key by an auxiliary party, indicated by a digital signature by the auxiliary party; and

grant access to the physical space when the plurality of delegations comprises a sequence of delegations coveting a delegation path from the access control device to the electronic key such that, in the sequence of delegations, the delegator of the first delegation is the access control device, the receiver of the last delegation is the electronic key, and the auxiliary condition is fulfilled.

Images